cti-pattern-validator
cti-pattern-validator copied to clipboard
Validate ANDed expressions match the same SCO
[file:name = 'foo' AND domain-name:value = 'example.com']
passes validation but should not. All Comparison Expressions connected by AND
must match against the same SCO, which by definition means they must be of the same object type (file != domain-name).
It would be legal if they were connected by OR
instead: [file:name = 'foo' OR domain-name:value = 'example.com']